{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48710", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T18:47:27.755Z", "datePublished": "2026-05-26T21:54:54.393Z", "dateUpdated": "2026-06-30T01:48:17.511Z"}, "containers": {"cna": {"title": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks", "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "lang": "en", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"}, {"name": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "tags": ["x_refsource_MISC"], "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"}, {"name": "https://badhost.org", "tags": ["x_refsource_MISC"], "url": "https://badhost.org"}, {"name": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "tags": ["x_refsource_MISC"], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"}, {"name": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "tags": ["x_refsource_MISC"], "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"}, {"name": "https://www.secwest.net/starlette", "tags": ["x_refsource_MISC"], "url": "https://www.secwest.net/starlette"}, {"name": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "tags": ["x_refsource_MISC"], "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"}], "affected": [{"vendor": "Kludex", "product": "starlette", "versions": [{"version": "< 1.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T21:54:54.393Z"}, "descriptions": [{"lang": "en", "value": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 \u00a73.2 / RFC 3986 \u00a73.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values."}], "source": {"advisory": "GHSA-86qp-5c8j-p5mr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T14:22:19.241769Z", "id": "CVE-2026-48710", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T14:26:57.893Z"}}, {"affected": [{"cpes": ["cpe:/a:redhat:ai_inference_server:3.3::el9"], "defaultStatus": "affected", "product": "Red Hat AI Inference Server 3.3", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"], "defaultStatus": "affected", "product": "Red Hat Ansible Automation Platform 2.6", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.7::el9"], "defaultStatus": "affected", "product": "Red Hat Ansible Automation Platform 2.7", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:satellite:6.18::el9"], "defaultStatus": "affected", "product": "Red Hat Satellite 6.18", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:satellite:6.19::el9"], "defaultStatus": "affected", "product": "Red Hat Satellite 6.19", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:exploit_intelligence:0"], "defaultStatus": "affected", "product": "Exploit Intelligence", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:migration_toolkit_applications:8"], "defaultStatus": "affected", "product": "Migration Toolkit for Applications 8", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_lightspeed"], "defaultStatus": "affected", "product": "OpenShift Lightspeed", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ai_inference_server:3"], "defaultStatus": "affected", "product": "Red Hat AI Inference Server", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "affected", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "affected", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "unaffected", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}], "datePublic": "2026-05-26T21:54:54.393Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Critical"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1289", "description": "Improper Validation of Unsafe Equivalence in Input", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-48710"}, {"name": "RHBZ#2481742", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:30089"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:30088"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:24866"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:23346"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:22993"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:26226"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:22992"}], "solutions": [{"lang": "en", "value": "RHSA-2026:30089: Red Hat AI Inference Server 3.3"}, {"lang": "en", "value": "RHSA-2026:30088: Red Hat AI Inference Server 3.3"}, {"lang": "en", "value": "RHSA-2026:24866: Red Hat Ansible Automation Platform 2.6"}, {"lang": "en", "value": "RHSA-2026:23346: Red Hat Ansible Automation Platform 2.7"}, {"lang": "en", "value": "RHSA-2026:22993: Red Hat Satellite 6.18"}, {"lang": "en", "value": "RHSA-2026:26226: Red Hat Satellite 6.18"}, {"lang": "en", "value": "RHSA-2026:22992: Red Hat Satellite 6.19"}], "timeline": [{"lang": "en", "time": "2026-05-26T23:01:03.204Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-26T21:54:54.393Z", "value": "Made public."}], "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header", "workarounds": [{"lang": "en", "value": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-06-30T01:48:17.511Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Critical", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:ai_inference_server:3.3::el9"], "vendor": "Red Hat", "product": "Red Hat AI Inference Server 3.3", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2.7::el9"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.7", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.18::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.18", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6.19::el9"], "vendor": "Red Hat", "product": "Red Hat Satellite 6.19", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:exploit_intelligence:0"], "vendor": "Red Hat", "product": "Exploit Intelligence", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:migration_toolkit_applications:8"], "vendor": "Red Hat", "product": "Migration Toolkit for Applications 8", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_lightspeed"], "vendor": "Red Hat", "product": "OpenShift Lightspeed", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ai_inference_server:3"], "vendor": "Red Hat", "product": "Red Hat AI Inference Server", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-05-26T23:01:03.204Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-05-26T21:54:54.393Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:30089: Red Hat AI Inference Server 3.3"}, {"lang": "en", "value": "RHSA-2026:30088: Red Hat AI Inference Server 3.3"}, {"lang": "en", "value": "RHSA-2026:24866: Red Hat Ansible Automation Platform 2.6"}, {"lang": "en", "value": "RHSA-2026:23346: Red Hat Ansible Automation Platform 2.7"}, {"lang": "en", "value": "RHSA-2026:22993: Red Hat Satellite 6.18"}, {"lang": "en", "value": "RHSA-2026:26226: Red Hat Satellite 6.18"}, {"lang": "en", "value": "RHSA-2026:22992: Red Hat Satellite 6.19"}], "x_adpType": "supplier", "datePublic": "2026-05-26T21:54:54.393Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-48710", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742", "name": "RHBZ#2481742", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:30089", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:30088", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:24866", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:23346", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:22993", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:26226", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:22992", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1289", "description": "Improper Validation of Unsafe Equivalence in Input"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-06-30T01:48:17.511Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48710", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T14:22:19.241769Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T14:26:50.071Z"}}], "cna": {"title": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks", "source": {"advisory": "GHSA-86qp-5c8j-p5mr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Kludex", "product": "starlette", "versions": [{"status": "affected", "version": "< 1.0.1"}]}], "references": [{"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "name": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "name": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "tags": ["x_refsource_MISC"]}, {"url": "https://badhost.org", "name": "https://badhost.org", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "name": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "tags": ["x_refsource_MISC"]}, {"url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "name": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "tags": ["x_refsource_MISC"]}, {"url": "https://www.secwest.net/starlette", "name": "https://www.secwest.net/starlette", "tags": ["x_refsource_MISC"]}, {"url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "name": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 \u00a73.2 / RFC 3986 \u00a73.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T21:54:54.393Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48710", "state": "PUBLISHED", "dateUpdated": "2026-06-30T01:48:17.511Z", "dateReserved": "2026-05-22T18:47:27.755Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-26T21:54:54.393Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "starlette", "vendor": "Kludex", "versions": [{"status": "affected", "version": "< 1.0.1"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-tpu-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-cpu-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-spyre-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-rocm-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-cuda-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-cuda-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-rocm-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "product": "ansible_automation_platform-2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaii/vllm-gaudi-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaii/vllm-rocm-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-tpu-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaii/vllm-cuda-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "ansible-automation-platform-26/lightspeed-chatbot-rhel9", "product": "ansible_automation_platform-2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-spyre-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaii/vllm-spyre-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "ansible-automation-platform-26/mcp-tools-rhel9", "product": "ansible_automation_platform-2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaii/vllm-cpu-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "mta/mta-solution-server-rhel9", "product": "mta-8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9", "product": "exploit-intelligence", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-ocp-rag-rhel9", "product": "ols-1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaii/vllm-tpu-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaiis/vllm-neuron-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhaii/vllm-neuron-rhel9", "product": "ai-inference-server-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-service-api-rhel9", "product": "ols-1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-caikit-nlp-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhelai3/bootc-aws-cuda-rhel9", "product": "rhel-ai-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "ask-sre", "product": "openshift-hosted-osd4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhelai3/bootc-azure-cuda-rhel9", "product": "rhel-ai-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-built-in-detector-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhelai3/bootc-gaudi-rhel9", "product": "rhel-ai-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhelai3/bootc-rocm-rhel9", "product": "rhel-ai-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhelai3/disk-image-cuda-rhel9", "product": "rhel-ai-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhelai3/bootc-gcp-cuda-rhel9", "product": "rhel-ai-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhelai3/bootc-cuda-rhel9", "product": "rhel-ai-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "satellite/iop-advisor-engine-rhel9", "product": "rhn_satellite_6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhel-cla/rlsapi-rhel10", "product": "rhel-cla-0", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhelai3/bootc-azure-rocm-rhel9", "product": "rhel-ai-3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-cuda-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-llama-stack-core-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-feature-server-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-gaudi-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-storage-initializer-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-caikit-tgis-serving-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-controller-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-feature-server-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-agent-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-router-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-gaudi-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-automl-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-mlflow-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-llama-stack-core-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-built-in-detector-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-built-in-detector-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-rocm-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-feature-server-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-mlserver-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-trustyai-nemo-guardrails-server-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-training-cuda128-torch29-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-storage-initializer-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-trustyai-nemo-guardrails-server-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-storage-initializer-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-training-cuda128-torch29-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-router-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-agent-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-controller-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-kserve-autogluon-server-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-vllm-gaudi-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-llm-d-kv-cache-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-mlflow-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-mlserver-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-llama-stack-core-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "aap-installers-rag-content", "product": "services-ansible-lightspeed-chatbot", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "satellite/iop-vulnerability-engine-rhel9", "product": "rhn_satellite_6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "satellite/iop-vmaas-rhel9", "product": "rhn_satellite_6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "satellite/foreman-mcp-server-rhel9", "product": "rhn_satellite_6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "satellite/iop-host-inventory-rhel9", "product": "rhn_satellite_6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "satellite/iop-host-inventory-rhel9", "product": "rhn_satellite_6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product": "openshift-ai", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "satellite/foreman-mcp-server-rhel9", "product": "rhn_satellite_6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "aap-rag-content", "product": "services-ansible-lightspeed-chatbot", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "ansible-chatbot-stack", "product": "services-ansible-lightspeed-chatbot", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "satellite/iop-vulnerability-engine-rhel9", "product": "rhn_satellite_6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "satellite/iop-vmaas-rhel9", "product": "rhn_satellite_6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "nexus", "product": "services-ansible-nexus", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "cloudservices/insights-inventory", "product": "services-inventory", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "insights-host-inventory", "product": "services-inventory", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "ansible-mcp-tools", "product": "services-ansible-lightspeed-chatbot", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "cloudservices/rbac", "product": "services-management-platform", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "digital-roadmap-backend", "product": "services-digital-roadmap", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "automation-analytics-backend", "product": "services-ansible-on-clouds", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "insights-rbac", "product": "services-management-platform", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "unknown@sha256:456a1542e13586a1c2cf1bbbb146124ca53041f5b9680becbebe10095afe881f/unknown@sha256:456a1542e13586a1c2cf1bbbb146124ca53041f5b9680becbebe10095afe881f", "product": "services-ansible-lightspeed-chatbot", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "okp-mcp", "product": "services-rhel-lightspeed", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected", "packageName": "google-lightspeed-agent", "product": "services-lightspeed-agent-google-cloud", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "cloudservices/vulnerability-engine-app", "product": "services-vulnerability-engine", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "vmaas", "product": "services-vulnerability-engine", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected", "packageName": "vulnerability-engine", "product": "services-vulnerability-engine", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*", "matchCriteriaId": "4C7C6045-86A6-4FAC-AE15-B12438E9D1B4", "versionEndExcluding": "1.0.1", "versionStartIncluding": "0.8.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 \u00a73.2 / RFC 3986 \u00a73.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values."}], "id": "CVE-2026-48710", "lastModified": "2026-06-17T10:55:13.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48710", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T14:22:19.241769Z", "version": "2.0.3"}}]}, "published": "2026-05-26T22:16:44.020", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://badhost.org"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://www.secwest.net/starlette"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-48710"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://badhost.org"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Patch"], "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Vendor Advisory"], "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Third Party Advisory"], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://www.secwest.net/starlette"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1289"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header", "id": "2481742", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-1289", "details": ["A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions."], "name": "CVE-2026-48710", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Affected", "package_name": "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:migration_toolkit_applications:8", "fix_state": "Affected", "package_name": "mta/mta-solution-server-rhel9", "product_name": "Migration Toolkit for Applications 8"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Affected", "package_name": "openshift-lightspeed/lightspeed-ocp-rag-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Affected", "package_name": "openshift-lightspeed/lightspeed-service-api-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaiis/vllm-cpu-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaiis/vllm-cuda-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaiis/vllm-neuron-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaiis/vllm-rocm-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaiis/vllm-spyre-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaiis/vllm-tpu-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaii/vllm-cpu-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaii/vllm-cuda-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaii/vllm-gaudi-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaii/vllm-neuron-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaii/vllm-rocm-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaii/vllm-spyre-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Affected", "package_name": "rhaii/vllm-tpu-rhel9", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/lightspeed-chatbot-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-26/mcp-tools-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-aws-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-azure-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-azure-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-gaudi-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-gcp-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-automl-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-built-in-detector-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-caikit-nlp-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-caikit-tgis-serving-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-agent-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-autogluon-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-controller-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-router-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-storage-initializer-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-llama-stack-core-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-llm-d-kv-cache-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-mlflow-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-mlserver-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-training-cuda128-torch29-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-trustyai-nemo-guardrails-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-vllm-cuda-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-vllm-gaudi-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-vllm-rocm-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "satellite/foreman-mcp-server-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "satellite/iop-advisor-engine-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "satellite/iop-host-inventory-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "satellite/iop-vmaas-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "satellite/iop-vulnerability-engine-rhel9", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-05-26T21:54:54Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48710\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48710\nhttps://badhost.org\nhttps://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6\nhttps://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr\nhttps://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml\nhttps://ostif.org/disclosing-the-badhost-vulnerability-in-starlette\nhttps://www.secwest.net/starlette\nhttps://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "starlette", "source": "cna", "vendor": "Kludex"}, "product": "starlette", "vendor": "kludex"}], "created": "2026-05-27T00:00:16.819747+00:00", "updated": "2026-05-28T04:45:07.559855+00:00", "vendors": ["kludex", "kludex$PRODUCT$starlette"]}